SQLite Database Viewer — Frontend Forensic Inspector
Upload and inspect SQLite databases directly in your browser.
SQLite Database Viewer — Frontend Forensic Inspector
Upload and inspect SQLite databases directly in your browser.
SQLite databases are widely used by mobile apps, browsers, desktop software, and operating systems. This viewer helps students inspect SQLite files safely in the browser, understand their structure, explore rows, review schemas, and learn how database artifacts can support digital forensic analysis.
Drag and drop a SQLite database
Accepted formats: .db, .sqlite, .sqlite3
Your database is processed locally in your browser. The file is not uploaded to MuhammadLab servers. For forensic work, always inspect a copy of the original evidence and document every step.
Forensic warning
This tool is designed for learning, teaching, and triage. It does not replace validated forensic software or formal evidence handling procedures.
Supported formats
Do not open unknown malicious files from untrusted sources without caution.
No database loaded
Upload a SQLite file or load the demo database to inspect tables, schema, rows, timestamps, BLOBs, and forensic notes.
Explain This Database
A quick learning layer to help students connect SQLite structure to forensic artifacts.
What is SQLite?
SQLite is a lightweight database engine stored in a single file. It is commonly embedded inside apps (mobile, desktop, browsers) to store structured data such as messages, settings, cache, and history.
Core concepts (table, row, column)
A table is like a spreadsheet. Columns define fields (e.g., timestamp, url, user_id). Each row is one record (e.g., one browser visit).
Primary keys, foreign keys, indexes
Primary keys uniquely identify rows. Foreign keys link rows across tables. Indexes speed up lookups and can reveal what an app searches frequently.
NULL, BLOB, timestamps
NULL means missing/unknown. BLOB stores binary data (images, files, encrypted blobs). Timestamps come in many formats; always confirm the epoch and units.
Digital forensics examples
SQLite is common in browser history databases, Android app databases, iPhone backups, messaging apps, and caches. Tables often include URLs, message bodies, contact IDs, login events, and sync metadata.
Forensic workflow (teaching-first)
Use a repeatable process when triaging SQLite evidence.
- 1Work on a copy of the database
- 2Identify tables and likely artifact locations
- 3Inspect schema (types, keys, relationships)
- 4Locate timestamp columns
- 5Decode timestamps (confirm units/epoch/time zone)
- 6Look for user identifiers (user_id, account_id, device_id)
- 7Export relevant rows and document filters/queries
- 8Document findings (hashes, tool version, steps taken)
Processed Locally
Your file never leaves your device. Everything is processed in your browser — we never see or store your data.
Related Tools
ADB Android Debug Bridge Guide - Android Forensics
Learn ADB installation, Android device connection, Android auditing commands, and forensic acquisition workflows.
macOS and iPhone Forensics Guide
Learn how macOS fits into iPhone evidence handling, local backups, MobileSync folders, plist files, and iOS artifact review.